[Draft] UV and Distroless

.github/dependabot.yml

@@ -22,8 +22,8 @@ updates:
       - dependency-name: "azimuth-cloud/github-actions/*"
 
   # Automatically propose PRs for Python dependencies
-  - package-ecosystem: pip
-    directory: "/api"
+  - package-ecosystem: uv
+    directory: "/"
     schedule:
       # Check for new versions daily
       interval: daily

.github/workflows/build-push-artifacts.yaml

@@ -70,7 +70,8 @@ jobs:
         uses: azimuth-cloud/github-actions/docker-multiarch-build-push@master
         with:
           cache-key: ${{ matrix.component }}
-          context: ./${{ matrix.component }}
+          context: .
+          file: ./${{ matrix.component }}/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.image-meta.outputs.tags }}

.github/workflows/test-pr.yaml

@@ -1,16 +1,15 @@
+---
 name: Integration tests
 
 on:
-  push
-  # We use pull_request_target so that dependabot-created workflows can run
-  #pull_request_target:
-  #  types:
-  #    - opened
-  #    - synchronize
-  #    - ready_for_review
-  #    - reopened
-  #  branches:
-  #    - master
+  pull_request: #TODO: This change should not make it into the final PR.
+    types:
+      - opened
+      - synchronize
+      - ready_for_review
+      - reopened
+    #branches:
+    #  - master
 
 # Use the head ref for workflow concurrency, with cancellation
 # This should mean that any previous workflows for a PR get cancelled when a new commit is pushed

.github/workflows/tox.yaml

@@ -1,3 +1,4 @@
+---
 name: Tox unit tests
 
 on:
@@ -14,29 +15,24 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.12']
+        python-version: ["3.12"]
 
     steps:
     - name: Check out the repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.ref || github.ref }}
 
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+    - name: Set up uv
+      uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
 
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install tox
-
     - name: Test with tox
-      run: tox
+      run: uv run tox
 
     - name: Generate coverage reports
-      run: tox -e cover
+      run: uv run tox -e cover
 
     - name: Archive code coverage results
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.gitignore

@@ -52,9 +52,6 @@ coverage.xml
 # PyBuilder
 target/
 
-# pyenv version file
-.python-version
-
 # Settings
 api/azimuth_site/settings.py
 
@@ -65,4 +62,5 @@ venv
 node_modules
 
 Chart.lock
-chart/charts
+chart/charts
+.stestr

.python-version

@@ -0,0 +1 @@
+3.12

api/Dockerfile

@@ -1,66 +1,76 @@
-FROM ubuntu:24.04 AS python-builder
+############################
+## INSTALL AND BUILD APP ###
+############################
+FROM ghcr.io/astral-sh/uv:trixie AS build
+# Note: distro should match final image stage to ensure build compat.
+# Non-slim version required for git.
 
-RUN apt-get update && \
-    apt-get install -y git python3 python3-venv && \
-    rm -rf /var/lib/apt/lists/*
+# https://docs.astral.sh/uv/guides/integration/docker/#optimizations
+ENV UV_NO_DEV=1 \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_CACHE_DIR=/uv-cache/
 
-RUN python3 -m venv /venv && \
-    /venv/bin/pip install -U pip setuptools
+WORKDIR /app-source
 
-COPY requirements.txt /app/requirements.txt
-RUN  /venv/bin/pip install --requirement /app/requirements.txt
+### INSTALL PYTHON ###
+# https://docs.astral.sh/uv/guides/install-python/
+ENV UV_PYTHON_INSTALL_DIR=/python \
+    UV_PYTHON_PREFERENCE=only-managed
+COPY .python-version /app-source
+RUN uv python install
+RUN chmod -R ugo=rX /python
 
-# Django fails to load templates if this is installed the "regular" way
-# If we use an editable mode install then it works
-COPY . /app
-RUN /venv/bin/pip install -e /app
+### INSTALL PROJECT ###
+# Create venv to install into
+RUN uv venv /app
+ENV VIRTUAL_ENV /app
 
+# Install the dependencies first- optimizes caching so if the app
+# changes but not the deps there is no need to rebuild this.
+COPY uv.lock pyproject.toml /app-source
+RUN --mount=type=cache,target=/uv-cache/ \
+    uv sync --active --frozen --no-install-project --no-dev --no-editable
 
-FROM ubuntu:24.04
+# Then install the app.
+COPY . /app-source
+RUN --mount=type=cache,target=/uv-cache/ \
+    uv sync --active --frozen --no-dev --no-editable
 
-# Don't buffer stdout and stderr as it breaks realtime logging
-ENV PYTHONUNBUFFERED 1
+RUN chmod -R ugo=rX /app
 
-# Make httpx and requests use the system trust roots
-# By default, this means we use the roots baked into the image
-ENV SSL_CERT_FILE /etc/ssl/certs/ca-certificates.crt
-ENV REQUESTS_CA_BUNDLE /etc/ssl/certs/ca-certificates.crt
+### INSTALL CONFIG ###
+COPY ./api/etc/gunicorn /etc/gunicorn
+COPY ./api/etc/azimuth /etc/azimuth
+RUN chmod -R ugo=rX /etc/azimuth
+RUN chmod -R ugo=rX /etc/gunicorn
 
-# Create the user that will be used to run the app
-ENV APP_UID 1001
-ENV APP_GID 1001
-ENV APP_USER app
-ENV APP_GROUP app
-RUN groupadd --gid $APP_GID $APP_GROUP && \
-    useradd \
-      --no-create-home \
-      --no-user-group \
-      --gid $APP_GID \
-      --shell /sbin/nologin \
-      --uid $APP_UID \
-      $APP_USER
-
-RUN apt-get update && \
-    apt-get install --no-install-recommends --no-install-suggests -y ca-certificates python3 tini && \
-    rm -rf /var/lib/apt/lists/*
+### PERFORM SETUP TASKS ###
+# Collect the static files into /var/azimuth
+ENV DJANGO_SETTINGS_MODULE flexi_settings.settings
+ENV DJANGO_FLEXI_SETTINGS_ROOT /etc/azimuth/settings.py
+RUN /app/bin/django-admin collectstatic
+RUN chmod -R ugo=rX /var/azimuth
 
-COPY --from=python-builder /venv /venv
-COPY --from=python-builder /app /app
+###########################
+### COMPILE FINAL IMAGE ###
+###########################
+FROM gcr.io/distroless/cc-debian13:debug-nonroot AS final
+# Note: distro should match build stage.
 
-# Install Gunicorn config
-COPY ./etc/gunicorn /etc/gunicorn
+### COPY IN APP ###
+# Files copied in must have their modes set so the nonroot user may read them.
+# You cannot do it here, chmod does not exist, and the docker flag doesn't work with podman yet.
+COPY --from=build /python /python
+COPY --from=build /etc/gunicorn /etc/gunicorn
+COPY --from=build /etc/azimuth /etc/azimuth
+COPY --from=build /app /app
+COPY --from=build /var/azimuth /var/azimuth
 
+### SETUP APPLICATION RUNTIME ###
 # Install application configuration using flexi-settings
 ENV DJANGO_SETTINGS_MODULE flexi_settings.settings
 ENV DJANGO_FLEXI_SETTINGS_ROOT /etc/azimuth/settings.py
-COPY ./etc/azimuth /etc/azimuth
-RUN mkdir -p /etc/azimuth/settings.d
-
-# Collect the static files
-RUN /venv/bin/django-admin collectstatic
-
-# By default, serve the app on port 8080 using the app user
+# By default, serve the app on port 8080
 EXPOSE 8080
-USER $APP_UID
-ENTRYPOINT ["tini", "-g", "--"]
-CMD ["/venv/bin/gunicorn", "--config", "/etc/gunicorn/conf.py", "azimuth_site.wsgi:application"]
+CMD ["/app/bin/gunicorn", "--config", "/etc/gunicorn/conf.py", "azimuth_site.wsgi:application"]

api/Dockerfile.dockerignore

@@ -0,0 +1,4 @@
+ui
+branding
+docs
+chart